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We propose the improved decoy state quantum key distribution incorporating finite statistics due to the finite 
code length and report on its demonstration. In our experiment, four different intensities including the vacuum 
state for optimal pulses are used and the key generation rate of 200 bps is achieved in the 20 km telecom optical 
fiber transmission keeping the eavesdropper's mutual information with the final key less than 2"'. 
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Quantum key distribution (QKD) was originally proposed 
by Bennett and Brassard in 1984 |1J as a protocol, by which 
two parties, Alice and Bob, share secret keys by using a quan- 
tum communication channel as well as a public classical chan- 
nel [2]. A remarkable feature is its unconditional security 
list]; it is guaranteed by the fundamental laws of quantum me- 
chanics and thereby QKD provides the unconditionally se- 
cure communication system. In the practical setting of op- 
tical communication, however, it is the almost only option 
to substitute qubits in the original BB84 QKD protocol with 
heavily attenuated laser pulses because the perfect single pho- 
ton emitting devices are not available in the current technol- 
ogy. Such laser pulses - the phase randomized weak coherent 
states - contain inevitably the multiphoton states at small but 
finite probability, which give a malicious eavesdropper (Eve) 
a chance to obtain some amount of information on the shared 
keys by a photon-number-splitting attack [4]. Gottesman-Lo- 
Liitkenhaus-Preskill (GLLP) showed, however, that it is still 
possible to obtain unconditionally secret key by BB84 proto- 
col with such imperfect light sources, although the key gener- 
ation rate and distances are very limited • 

The recently proposed decoy state method |S H H 01 is 
one of the promising practical solutions to BB84 QKD with 
coherent state light pulses, in which several coherent state 
light pulses with diff'erent intensities are used. Such optical 
pulses with different intensities have diff'erent photon num- 
ber statistics. This simple fact equips Alice and Bob with a 
countermeasure against Eve. The original idea of the decoy 
state QKD is due to Hwang |6]. So far, several experimen- 
tal demonstrations of decoy state QKD have been reported 
In most cases, the security analysis is 
based on the GLLP's asymptotic arguments, whereas, in the 



practical setting, the code length is finite so that the asymp- 
totic argument is no longer valid and the unconditional secu- 
rity is actually not guaranteed any more. The security analysis 
of QKD with the finite code size must incorporate the statis- 
tical fluctuations of the observed quantities [15J. Although 
several authors have considered the influence 

of statistical fluctuations on the decoy state QKD with finite 
code length, what all of them have done is limited to the re- 
adjustment of parameters of the asymptotic GLLP's formula 
for the secure key generation rate. Such an ad hoc treatment 
cannot be justified to claim the unconditional security. 

In this paper, we propose a substantially improved decoy 
state QKD in the framework of finite coding length |17] and 
report on its experimental results. In our experiment, we 
employ the decoy state method with three decoy pulses and 
demonstrate that in the 20 km optical fiber transmission, the 
final key was successfully generated at the rate 200 bps keep- 
ing the eavesdropper's mutual information with the final key 
less than 2"^. 

In our protocol, we use k -¥ 1 different intensities or mean 
photon numbers = < yui < . . . < fi^ including vacuum 
(//()) for the optical pulses. Two conjugate bases (+ and x) are 
treated separately so that 2^-1-1 different pulses are involved in 
total. The vacuum state (/ - 0) is sent at the probability ]5q and 
the yUj pulse with x (-h) basis is sent at the probability p/ (pj^i^ 
(i = I, . . .,k) The pulse with intensity (pi^+k) (the signal 
pulse) is used to distill the final secret key and the remainings 
(decoy pulses) are used just for estimation of Eve's attacks 
and/or the noise characteristics of quantum channel. 

The code length (size of raw key) is denoted by and the 
time slot to generate a final secure key is denoted by T. We 
also fix the maximum number of the size of final key. Our 
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protocol is as follows. Within the time slot T, Alice randomly 
sends Bob a sequence of optical pulses of fe + 1 different inten- 
sities with randomly chosen basis. After that, Bob performs 
a measurement in one of the two bases and Alice and Bob 
compare bases and keep the pulses with a common basis by 
communicating via public channel. The number of sending 
pulses, received pulses, and pulses of a common basis are de- 
noted by, respectively. A,-, C,, and £, {i - 0, . . . , 2k). The 
Ei bit string of /th pulse contains error bits, which will be 
detected by checking a portion of the bits (check bits). To 
prepare check bits, Alice and Bob firstly perform the random 
permutation on Ei^ and Ei^+k bit strings by sharing common 
random numbers via public channel. Then, for / = Iq and 
i - io + k, the first bit string is used as the raw key and 
the remaining £,„ - and Ej^+k - N bit string are used as 
the check bits, while the whole bits are used as check bits 
for / 9^ /(), io + k. (If Ejg < N or E/^+k < N, then the proto- 
col is aborted.) The number of detected errors of ith pulse is 
denoted by //, (/ = 1, . . . , 2k). From these quantities, Alice 
and Bob can evaluate the size of the final key guaranteeing 
the unconditional security. If the evaluated final key size is 
not positive, the protocol is aborted again. The final secret 
key N final is computed as Nr]{Hi^+kl{Ei^+k - N)) - m^ax for 
+ basis and N final is computed as Nri{Hi^l(Ei^, - N)) - m„ax 
for X basis, where ?](■) denotes the error correcting coding rate 
and nimax {ni„ax) represents the size of privacy amplification. 
If 77 < N final (N < N final), they replace A?/,™/ (Nfi„ai) by A^. 

The error correction (or reverse reconciliation in our pro- 
tocol) is performed as follows. Suppose that Alice and Bob 
have, respectively, the random number sequences X and X' of 
n bits, which contain some errors. The task is to distill the 
common random number sequence of / bits with negligible 
errors. Let G be the generator matrix of [n, I] classical error 
correcting code. Bob generates the random number sequence 
Z e {0, 1)' and sends the bit string GZ+X' to AHce. Then 
Alice decodes GZ+X' - X to extract Z. For the classical er- 
ror correcting code. Low Density Parity Check (LDPC) code 
OlSll is used. The advantage of LDPC code is that the decoding 
with 0(n) operations is possible by using Sum-Product decod- 
ing method OlSll . where n is the coding length. Furthermore, 
the coding rate achieves the Shannon limit asymptotically. In 
the privacy amplification, we use the universala hash function. 
More specifically, we use (I - m) x I Toeplitz matrix Mp fl9^ 
to subtract m bit information from the original information of 
/ bits. 

Now, let us describe the Eve's possible attacks. To this end, 
we firstly define multiphoton states pi (I - 2, . . . ,k + I) as 

p/ = ^^r'2r=i7fi«)<«iwith 



i-i 



yt, 



(jU/_l - fli-2) ■ ■ ■ (f^l-l - fll)nf_ifJ-"j 



.n-2 



^ (Mj - fii-O- ■■(Mj- - Mj-i) ■ ■ ■ (Mj - ^i) ' 



Q.I being the normalization constant and fii < ^2 < ■ ■ ■ < l-tk- 

The phase-randomized coherent state, e"''' Yj7=o ^ I") ^"1 ^'^^ 
be expressed as a convex combination of |0) (0|, |1) and p,-. 
Here, we adopt the worst case scenario. Namely, we assume 



that Eve can distinguish vacuum state (j - 0), single pho- 
ton state (j - 1), multiphton states p2, . ■ ■ ,pk+\ with x basis 
{] - 2, . . . ,k+\) and those with + basis {j - k + 2, . . . ,2k+\). 
The number of /'th state (j - Q, . . .,2k + 1) is denoted by BK 
According to the values of B^, Eve can do the following at- 
tacks; She tricks Bob into detecting the 7th state with prob- 
ability <7' and causes phase errors with probability r' for the 
y'th state {j - \,2, . . . ,k + \) and bit errors with probability P 
for the yth state {j - \,k + 2, . . . ,2k + \). In the following, 
we focus on the + basis case. The detection ratio p, = C,7A, 
(/ = 0, . . . , 2k) is written in terms of as 



2k+\ 
7=0 



(1) 



where po is the detector dark count rate and P^. is the gen- 
eration probability of the jth state given that the /th pulse is 
emitted. The error probability HijEi (i io, I < i < k) 
and s,„ = /(£■,„ - A^) satisfies 1I20I1 



SiPi 



(2) 



In our decoy state method, Alice and Bob try to estimate pa- 
rameters q-' and r-i (P) from the observed quantities C, E, and 
H to the best of their ability. The complete determination is, 
however, beyond their ability so they put the safety standards 
most stringent. The computed size of privacy amplification is 
thus given by 



max m(x,y), 

0<a<a/2(1-pd),0<v<1 



(3) 



where 



m(x, y) 



Nq'(x)[h(rHx,y))-l] 



C, 



io+k 



yj^'o+kPl+kd ~ P\a+k'^ 



+ ^|vx,y,iMML(x,y), rML{x,y)) [-<D-'(2-*^)] + ^3 (4) 
with <5i(2,3) being security parameters. Here, 

1 r 
^(x) = — — e ^ dx 
V27r J-oc 



and 

h(x) 



1 ifl/2<x<l, 
-xlogj X - (1 - x) log2(l - x) if < X < 1/2. 



In Eq. dUl, jc = (^*+i + ^2*^+')/ V2 and 3; = r*+i; q\x) and 
r^(x,y) are direct solutions of Eqs. ([T]) and (|2]) as a function 
of X and y, while qML(x,y) and rMLix,y) are values of max- 
imal likelihood estimation. Furthermore, m^o and y /j, are, 
respectively, the mean and variance of the stochastic variable 
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pj ^ EiiJLeJ + A'F^ and , 

'0 t-i„ 10 '0 lo+k 



.)->! 



+ N - Ft\,, 



where - r-T-! + 



AG/ 
with £■/ 



= kd + Ke^ and d = fl^B-?' + A'C^' (Cr' = 
poAi + A Cr'). These stochastic variables as well as obey 
the respective hypergeometric distributions, which are fully 
incorporated in the computation of v.i,y./o- 

Now, let us go back to Eq. (|3]l. To ensure that the leakage 
information is less than 2^^, it is sufficient to choose 6\ - 
5 + flog, A^l + 1 and ^2 = (53 = 5 + riog2 W\ + 2. The detail 
will be published elsewhere 112 ill . 

Experiment. — The key generation experiment was done 
with a 20 km-long optical fiber in a common office envi- 
ronment. The setup, working on the 62.5 MHz clock, was 
based on the "plug-and-play" QKD system used in the 14- 
day s-continuous quantum key distribution experiment ll22ll . 
The wavelength of the light was 1.55 yum. The intensity of 
the optical pulses were randomly chosen with a dual-drive 
Lithium Niobate Mach-Zehnder intensity modulator f23\ . The 
modulator provides phase shifts simultaneously to define the 
four BB84 states, as the output wave is given by Eom - 
Eint cos[(0i -02)/2] exp[/(0i +02)/2], where (pi and 02 are the 
phase shifts in the two arms of Mach-Zehnder interferometer. 
We employed "alternative-shifted-phase-modulation" to use a 
polarization dependent device [24]. A PC with Pentium(R)4 
(3GHz) CPU and 2 GB memory was connected to the QKD 
apparatus to perform the error correction and privacy ampli- 
fication. The random numbers used in the experiment were 
generated by a physical random number generation hardware. 

Before running the protocol, the detector dark count rate 
po must be determined in advance, which was measured as 
3.00 X 10 per pulse. We used pulses with three different fi- 
nite intensities jui, p2, and p^ in addition to the vacuum state 
(k - 3) because at least four different intensities including 
vacuum are needed to achieve the almost optimal secure key 
generation rate asymptotically lEsll . The final key was dis- 
tilled from the p^ pulses sequence. We set pj, = 0.5. This is 
due to the observation that at the limit pi,p2 — > 0, the choice 
of pc = 0.5 yields the best final key generation rate asymptot- 
ically f23\. The others are set to be p\ — 0.07 and p2 - 0.35, 
which are the smallest two values available in our system. The 
security parameters were set to be (5 = 9 so that Eve's mutual 
information with the final key is guaranteed to be less than 

2-'>m}- 

The size of LDPC code was 1.0 x 10"*. The Sum-Product 
method is an approximate decoding one so that there is a finite 
probability of decoding without converging. In our case, the 
unconverging probability was about 3 x 10"^. If the decoding 
is unsuccessful, the bit string must be discarded, but after the 
successful decoding, the bit error rate was reduced to as small 
as 1.0 X 10"'". The coding length was set to be 10 times 
of the LDPC coding length 1.0 x 10"* (A? = 1.0 x 10^) and the 
error correction was performed on each lO'* bit block of A^. 

We performed the above-described QKD experiment for 40 
rounds. The sum of the key generation rate of -i- and x bases 
is shown in Fig [T] We set the time slot T =41.8 sec and 
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FIG. 1: Sum of key generation rates of + and x bases. Error rates 
were the average of two bases. 



TABLE I: Number of received bits and check bits. 





Received Bits 


Check Bits 


Intensity 


+ basis X basis 


+ basis 


X basis 


Vacuum 


52399 






0.07 


172935 173779 


88406 


84430 


0.35 


177279 178666 


89967 


87700 


0.50 


784750 786163 


294847 


292321 



Aq : Ai(= A4) : A2(= A5) : Ae) = 0.125 : 0.1875 : 

0.0625 : 0.1875. We also fix A^ = 2'^ which maximizes the 
average of the key generation rates. The number of received 
pulses C, and the check bits for the coding length A^ = 1 .Ox 1 0^ 
are listed in Table U When the error rate on -i- (x) basis was 
5.2% (6.1%), the final secret key of 8.2x 10^ bit was generated 
and the generation rate was around 200 bps. In this case the 
raw key of A^ = l.OxlO^bit was reduced to the size of 5.6x 10 
bit by error correction and further to the size of 4.1 x 10^ bit 
by privacy amplification on each basis. If the error rates were 
more than 6.5%, then few final secret key was left. Although 
the key generation rates obtained in our experiments are not 
so large, the most important point is that the final keys are 
guaranteed to be unconditionally secure in our decoy method 
while previously reported ones 

IB m El E & 

are not. 

The small values of the key generation rates are due to the 
statistical fluctuations of observed quantities which are never 
negligible even if the code length is 1 .0 x 10^. 

Discussion on experimental parameters. — Many adjustable 
parameters are involved in our protocol and some of them are 
in the trade-off relation. In the following, we clarify, albeit 
qualitatively, the dependence of these parameters on our de- 
coy state QKD experiment for further improvements. 

Firstly, the sending probability of the signal pulse must be 
large enough to ensure £3, £6 > A^. We also performed the 
same experiment but under the condition Aq : Ai(= A4) : 
A2(= A5) : A3(= Ae) = 0.125 : 0.125 : 0.125 : 0.125 and the 
resulting generation rate of the secret key was around 50 bps, 
which is less than that of Fig [T] However, the sending prob- 
ability of pulses with intensities p\ and p2 also must not be 
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too small. Otherwise, the statistical error of estimating Eve's 
parameters would become large reducing the size of final key. 
After all, our choice of sending probabilities that check bits 
for the intensity 0.07 are as much as those for the intensity 
0.35 in TableUis quite favorable, although it is not optimized. 

Secondly, the processing time of each step in our proto- 
col affects directly the key generation rate. The most time- 
consuming process is the sharing of common random numbers 
via quantum channel. It took around 42 sec in the experiment 
to obtain the results of Fig [T] The second one is the compu- 
tation of the size of privacy amplification, which requires the 
nested numerical optimization and took around 10 sec. The 
generation of physical random numbers also took around 10 
sec, but they did not degrade the total performance since they 
were performed in a parallel manner The random permuta- 
tion, error correction, and privacy amplification were the least 
time-consuming processes; they took only a few seconds. 

Thirdly, the length of the time slot T is also one of the 
adjustable parameters. The numbers of received pulses C,-, 
pulses with a common basis, and the check bits are propor- 
tional to T . When these numbers are too small the contribu- 
tion of statistical fluctuation of the right-hand side of Eq. (|4]i 
becomes large reducing the size of the final secret key. Thus, 
T must be large enough. However, too large T merely re- 
sults in low key generation rate since the parameter estima- 
tion is not improved any longer for sufficiently large value of 
T . Thus, we can expect there is some optimal value of T . 
Under the same conditions of our experiment, the largest key 
generation rate is expected to be achieved when the smallest 
size of check bits (for the intensity 0.07 in Fig [T]) is around 
85% of the coding length = 1.0 x 10^ 

Finally, let us briefly discuss the size of random numbers 
used in our experiment. The random numbers, which are 
all physical random numbers, are used for random permu- 
tation, error correction, and the generation of Toeplitz ma- 
trix. Among them, the random permutation is most demand- 
ing; it requires the random numbers of the size 0(N log N) ^ 
1 .7 X 10* bits since each bit in £3 (£■<,) is randomly exchanged. 

The overall performance of decoy state QKD could be im 



proved if we used the unidirectional QKD system 11261 12711 
instead of 'plug-and-play' system here. By doing so, a larger 
bit string of common random numbers would be available so 
that the better performance of error correction and therefore 
higher secret key distillation rate would be expected. In our 
experiment, the bottleneck of the key generation time is the 
common random number sharing via quantum channel. This 
would be resolved if the transmission rate of optical pulses 
was improved, however, the computational time of the size of 
privacy amplification would emerge as the second difficulty. 
The time of random number sharing via quantum channel is 
proportional to the coding length A^, while the time of gener- 
ating physical random numbers is proportional to 0(N log N). 
Therefore, if is too large, the generation of random numbers 
may affect seriously the total performance. 

In summary, we have proposed and demonstrated the im- 
proved decoy state QKD incorporating finite statistics due to 



the finite code length. We employed the decoy state method 
with four different intensities including vacuum state for op- 
tical pulses and achieved the final key generation rate of 200 
bps in 20 km telecom optical fiber transmission keeping the 
eavesdropper's mutual information with the final key as small 
as 2"^. We also discussed the dependence of several parame- 
ters on our QKD experiment. 
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